{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/quasar-framework--2.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:quasar-framework:quasar:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-106102"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Quasar Framework (\u003c 2.22.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Quasar"],"content_html":"\u003cp\u003eQuasar Framework versions prior to 2.22.0 contain a critical vulnerability in the server-side rendering (SSR) utility \u003ccode\u003egetHead()\u003c/code\u003e, located in \u003ccode\u003eui/src/plugins/meta/Meta.js\u003c/code\u003e. This function is responsible for serializing metadata - such as page titles, meta descriptions, and link tags - collected via the \u003ccode\u003euseMeta()\u003c/code\u003e composable into raw HTML for initial server-side rendering.\u003c/p\u003e\n\u003cp\u003eThe vulnerability exists because \u003ccode\u003egetHead()\u003c/code\u003e uses insecure template-literal interpolation to construct HTML strings without any HTML-entity or attribute-quote escaping. In contrast, the client-side \u003ccode\u003eapply()\u003c/code\u003e method uses safe DOM APIs (\u003ccode\u003edocument.createElement\u003c/code\u003e and \u003ccode\u003esetAttribute\u003c/code\u003e) that handle escaping automatically. Because \u003ccode\u003egetHead()\u003c/code\u003e is a parallel, independent implementation for the SSR path, it remains vulnerable. An attacker can input strings containing HTML metacharacters (e.g., \u003ccode\u003e\u0026lt;/title\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026quot;\u003c/code\u003e, \u003ccode\u003e\u0026gt;\u003c/code\u003e) through any application input that eventually populates \u003ccode\u003euseMeta()\u003c/code\u003e, resulting in the injection of arbitrary malicious markup, including \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tags, into the server-rendered HTML response.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application input field (e.g., blog post title, user display name, or CMS field) that is processed and rendered by the Quasar SSR \u003ccode\u003euseMeta()\u003c/code\u003e composable.\u003c/li\u003e\n\u003cli\u003eAttacker submits a payload containing malicious HTML characters, such as \u003ccode\u003eMy Post\u0026lt;/title\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application backend stores this malicious string in the database or passes it to the SSR rendering pipeline.\u003c/li\u003e\n\u003cli\u003eA victim requests the page, triggering the Quasar SSR \u003ccode\u003egetHead()\u003c/code\u003e utility on the server.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetHead()\u003c/code\u003e function serializes the malicious payload into the raw HTML \u003ccode\u003e\u0026lt;head\u0026gt;\u003c/code\u003e segment without escaping characters.\u003c/li\u003e\n\u003cli\u003eThe server sends the unsanitized HTML response to the victim's browser.\u003c/li\u003e\n\u003cli\u003eThe browser parses the injected \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tag before hydration, executing the attacker-supplied JavaScript in the context of the site origin.\u003c/li\u003e\n\u003cli\u003eThe script performs malicious actions such as exfiltrating \u003ccode\u003edocument.cookie\u003c/code\u003e or overlaying phishing content.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for reflected or stored Cross-Site Scripting (XSS). This gives the attacker the ability to steal user session cookies, perform unauthorized actions on behalf of the user, modify the page content, or redirect users to malicious domains. The vulnerability is highly impactful because \u003ccode\u003euseMeta()\u003c/code\u003e is a primary and common component used in almost all dynamic Quasar SSR applications, making a wide range of content-heavy sites potentially susceptible to trivial exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and security engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Quasar Framework to version 2.22.0 or later immediately to patch CVE-2026-106102.\u003c/li\u003e\n\u003cli\u003eAudit existing SSR implementations for \u003ccode\u003euseMeta()\u003c/code\u003e usage where user-controlled input might be processed and rendered server-side.\u003c/li\u003e\n\u003cli\u003eImplement a rigorous server-side HTML-escaping routine for all metadata attributes if an immediate framework update is not possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-07T16:56:46Z","date_published":"2026-10-07T16:56:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-quasar-xss/","summary":"The Quasar Framework's server-side rendering (SSR) mechanism in versions prior to 2.22.0 fails to escape HTML characters in meta tags, allowing attackers to inject and execute arbitrary JavaScript in the victim's browser.","title":"Stored/Reflected XSS in Quasar Framework SSR via Unescaped Meta Tag Rendering","url":"https://feed.craftedsignal.io/briefs/2026-10-quasar-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Quasar Framework (\u003c 2.22.0)","version":"https://jsonfeed.org/version/1.1"}